B-3
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
78-16527-01
Appendix B Signature Engines
MASTER Engine
–
RPC—Inspects RPC traffic.
–
SMB—Inspects SMB traffic.
–
SNMP—Inspects SNMP traffic.
–
SSH—Inspects SSH traffic.
•
STATE—Stateful searches of HTTP strings.
The state engine now has a hidden configuration file that is used to define the state transitions so
new state definitions can be delivered in a signature update.
•
STRING—Searches on Regex strings based on ICMP, TCP, or UDP protocol.
There are three STRING engines: STRING.ICMP, STRING.TCP, and STRING.UDP.
•
SWEEP—Analyzes sweeps from a single host (ICMP and TCP), from destination ports (TCP and
UDP), and multiple ports with RPC requests between two nodes.
•
TRAFFIC.ICMP—Analyzes nonstandard protocols, such as TFN2K, LOKI, and DDOS. There are
only two signatures, the LOKI signatures, with configurable parameters.
•
TROJAN—Analyzes traffic from nonstandard protocols, such as BO2K andTFN2K.
There are three Trojan engines: Bo2k, Tfn2k, and UDP. There are no user-configurable parameters
in these engines.
MASTER Engine
The MASTER engine provides structures and methods to the other engines and handles input from
configuration and alert output. This section describes the MASTER engine, and contains the following
topics:
•
General Parameters, page B-3
•
Alert Frequency, page B-4
•
Event Actions, page B-5
General Parameters
The following parameters are part of the MASTER engine and apply to all signatures.
Caution
We do not recommend that you change the promisc-delta setting for a signature.
Promiscuous delta lowers the RR of certain alerts in promiscuous mode. Because the sensor does not
know the attributes of the target system and in promiscuous mode cannot deny packets, it is useful to
lower the prioritization of promiscuous alerts (based on the lower risk rating) so the administrator can
focus on investigating higher risk rating alerts.
In inline mode, the sensor can deny the offending packets and they never reach the target host, so it does
not matter if the target was vulnerable. The attack was not allowed on the network and so we do not
subtract from the risk rating value.
Signatures that are not service, OS, or application-specific have 0 for the promiscuously delta. If the
signature is specific to an OS, service, or application, it has a promiscuous delta of 5, 10, or 15 calculated
from 5 points for each category.